Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/chaterm/terminal-skills/aws-clinpx skills add chaterm/terminal-skills --skill aws-cligit clone --depth 1 https://github.com/chaterm/terminal-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/chaterm/terminal-skills/aws-cli)<a href="https://agentmods.dev/skills/chaterm/terminal-skills/aws-cli"><img src="https://agentmods.dev/badge/skills/chaterm/terminal-skills/aws-cli.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00007 | $0.01783 |
| Opus 5 | $0.00003 | $0.00892 |
| Sonnet 5 | $0.00001 | $0.00357 |
| Haiku 4.5 | $0.00001 | $0.00178 |
Grade C, and why
aws-cli scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reaches for credential fileshighPrivilege escalation
SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.
~/.aws/credentials How it starts
The opening of the file, as written. The whole thing — 279 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AWS CLI 操作
概述
EC2、S3、IAM、Lambda 等 AWS 服务的命令行操作技能。
配置与认证
# 配置凭证
aws configure
aws configure --profile myprofile
# 查看配置
aws configure list
aws configure list --profile myprofile
# 配置文件位置
~/.aws/credentials
~/.aws/config
# 使用环境变量
export AWS_ACCESS_KEY_ID=xxx
export AWS_SECRET_ACCESS_KEY=xxx
export AWS_DEFAULT_REGION=us-east-1
# 使用 profile
export AWS_PROFILE=myprofile
aws s3 ls --profile myprofile
# 获取当前身份
aws sts get-caller-identity
EC2 实例
实例管理
# 列出实例
aws ec2 describe-instances
aws ec2 describe-instances --filters "Name=instance-state-name,Values=running"
aws ec2 describe-instances --query 'Reservations[*].Instances[*].[InstanceId,State.Name,PublicIpAddress]' --output table
# 启动/停止实例
aws ec2 start-instances --instance-ids i-1234567890abcdef0
aws ec2 stop-instances --instance-ids i-1234567890abcdef0
aws ec2 reboot-instances --instance-ids i-1234567890abcdef0
# 终止实例
aws ec2 terminate-instances --instance-ids i-1234567890abcdef0
# 创建实例
aws ec2 run-instances \
--image-id ami-12345678 \
--instance-type t3.micro \
--key-name my-key \
--security-group-ids sg-12345678 \
--subnet-id subnet-12345678 \
--count 1
安全组
# 列出安全组
aws ec2 describe-security-groups
aws ec2 describe-security-groups --group-ids sg-12345678
# 创建安全组
aws ec2 create-security-group \
--group-name my-sg \
--description "My security group" \
--vpc-id vpc-12345678
# 添加入站规则
aws ec2 authorize-security-group-ingress \
--group-id sg-12345678 \
--protocol tcp \
--port 22 \
--cidr 0.0.0.0/0
# 删除规则
aws ec2 revoke-security-group-ingress \
--group-id sg-12345678 \
--protocol tcp \
--port 22 \
--cidr 0.0.0.0/0
S3 存储
基础操作
# 列出桶
aws s3 ls
# 列出对象
aws s3 ls s3://bucket-name/
aws s3 ls s3://bucket-name/prefix/ --recursive
# 创建桶
aws s3 mb s3://bucket-name
aws s3 mb s3://bucket-name --region us-west-2
# 删除桶
aws s3 rb s3://bucket-name
aws s3 rb s3://bucket-name --force # 包括内容
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 279 lines · 7 tokens per session scan C 7c8701cf3077
aws-cli is a skill published in the GitHub repository chaterm/terminal-skills (58 stars, last pushed 6mo ago), licensed Apache-2.0. It adds 7 tokens to every session and 1,783 once invoked, about $0.0000 per session on Opus 5. A static security scan graded it C with 1 finding (reaches for credential files). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
aws-essentials
Use when standing up the core AWS surface a small product needs: hardening a fresh account, a private S3 bucket, encrypted RDS Postgres, ECS Fargate vs EC2, CloudFront + OAC, or scoping an IAM policy to least privilege. NOT the CI pipeline that ships the container (that is deployment), NOT app-code access-control…
cis-aws-foundations-2.21
Ensure AWS resource policies do not allow unrestricted access using "Principal": "".
cis-aws-foundations-2.16
Ensure IAM instance roles are used for AWS resource access from instances.
cis-aws-compute-5.7
Ensure you are using an IAM policy to manage access to buckets in Lightsail.
aws-cli
Operational skill for AWS CLI v2: profiles and SSO, IAM least privilege, S3, EC2, Lambda, CloudWatch Logs, and safe account/region confirmation before mutations.
aws-metadata-ssrf
Exploit Server-Side Request Forgery (SSRF) vulnerabilities in applications hosted on AWS EC2 instances to extract IAM credentials and User Data from the Instance Metadata Service (IMDS). This skill covers techniques for bypassing basic filters to access IMDSv1 and concepts of IMDSv2.